✨ AI
Sign inBook a demo
Security

Security Advisories & Vulnerability Disclosures

Security guides how we design, build, test, and ship rConfig, from the first code change through to each release.

Closed advisory, for awareness: critical PHP vulnerabilities

Why Security Matters in Network Configuration Management

In modern IT and OT environments, Network Configuration Management platforms sit directly inside the security perimeter. They control device access, store sensitive configuration data, and automate privileged operations across critical infrastructure.

rConfig plays a central role in helping network and security teams enforce policy, maintain compliance, and reduce risk, while protecting against unauthorized access, configuration drift, and compromise.

Security is not treated as a feature. It is embedded across our architecture, development lifecycle, testing processes, and release management.

Our Approach to Disclosure

We publish every confirmed vulnerability in rConfig, credit the researchers who report them, and register CVEs through GitHub and VulnCheck. When a fix ships, we list the affected and fixed versions here so you can check your installation.

Security by Design, Platform Safeguards

  • Role-Based Access Control (RBAC)

    Available in rConfig Pro. Granular permissions per user, role, device, and action. Essential for multi-admin and regulated environments.

  • Secure API Endpoints

    Token-based authentication, HTTPS-only, optional IP allow-listing, and role-scoped API tokens.

  • Automated Vulnerability Scanning

    Dependency scanning (OWASP, GitHub advisories), static code analysis, and continuous CI/CD enforcement.

  • 5,700+ Tests in the Product Suite

    Unit tests, feature tests, integration & API tests, and regression coverage.

Am I affected?

  • rConfig Core: upgrade to 8.2.20 or later.
  • rConfig Pro: upgrade to 8.4.1 or later. 8.4.2 is due shortly and includes further fixes.
  • After upgrading from an affected version, rotate the secrets stored in rConfig: REST API tokens, device and enable passwords, SMTP, LDAP and RADIUS secrets. Review your user list for accounts you don't recognise.
  • Questions: security@rconfig.com.

Published Security Advisories

Published advisories for rConfig Core and Pro, newest first, with the affected and fixed versions for each so you can check your installation.

  • Advisory
    rCFG-SA-2026-10
    Table export disclosed stored credentials and API tokens
    The table export did not enforce its list of excluded tables and wrote encrypted columns in clear text, so any signed-in user could export API tokens and stored device, enable and SMTP passwords. After upgrading, revoke and recreate API tokens and rotate stored credentials.
    Credit: kta1kri, Samuel Lao
    Published
    2026-11-06
    Severity
    High
    Core versions
    8.1.0 to 8.2.19
    Fixed in 8.2.20
    Pro versions
    up to 8.3.3
    Fixed in 8.4.0
    CVE and GHSA
    Pending
    GHSA-j6h2-mff2-6gwf
    Status
    Fixed
  • Advisory
    rCFG-SA-2026-09
    Remote code execution via the job queue (Redis and Horizon)
    A signed-in user could reach the internal Redis queue through a device pointing at the rConfig server and run commands as the queue worker, which ran as root on some installs. Redis now requires a password, the worker no longer runs as root, and such device targets are blocked.
    Credit: Reported via VulnCheck
    Published
    2026-11-06
    Severity
    Critical
    Core versions
    8.0.0 to 8.2.18
    Fixed in 8.2.19
    Pro versions
    up to 8.4.0
    Fixed in 8.4.1
    CVE and GHSA
    CVE-2026-124079
    Status
    Fixed
  • Advisory
    rCFG-SA-2026-08
    Stored cross-site scripting in the Config Search matches dialog
    Stored configuration content could run script in another user's browser when shown in the Config Search matches dialog.
    Published
    2026-09-10
    Severity
    High
    Core versions
    8.0.0 to 8.2.16
    Fixed in 8.2.17
    Pro versions
    up to 8.3.3
    Fixed in 8.4.0
    CVE and GHSA
    Pending
    GHSA-vx3w-xf2x-5335
    Status
    Fixed
  • Advisory
    rCFG-SA-2026-07
    Authenticated remote code execution via PHP object injection in EncryptStringCast
    A crafted stored value could be deserialised by EncryptStringCast, allowing a signed-in user to run code on the server.
    Published
    2026-09-10
    Severity
    High
    Core versions
    8.0.0 to 8.2.16
    Fixed in 8.2.17
    Pro versions
    up to 8.3.3
    Fixed in 8.4.0
    CVE and GHSA
    Pending
    GHSA-66q6-ghqr-4cq2
    Status
    Fixed
  • Advisory
    rCFG-SA-2026-06
    Device credential passwords returned by the v1 REST API
    The v1 REST API returned shared device credential passwords in clear text to any API token holder. These values are now masked.
    Credit: Reported via VulnCheck
    Published
    2026-11-06
    Severity
    Medium
    Core versions
    8.2.3 to 8.2.12
    Fixed in 8.2.13
    Pro versions
    Not affected
    CVE and GHSA
    CVE-2026-70555
    Status
    Fixed
  • Advisory
    rCFG-SA-2026-05
    Authenticated users could change other users' passwords
    The user update endpoint did not check that the caller could change the target account, so any signed-in user could set another user's password, including an administrator's.
    Credit: Adam Nurudini (QwesiRED)
    Published
    2026-11-06
    Severity
    High
    Core versions
    8.0.0 to 8.2.12
    Fixed in 8.2.13
    Pro versions
    up to 8.3.3
    Fixed in 8.4.0
    CVE and GHSA
    Pending
    GHSA-5j22-4wg3-pxvh
    Status
    Fixed
  • Advisory
    rCFG-SA-2026-04
    Authenticated path traversal in the export download endpoint
    The export download endpoint accepted path traversal, letting a signed-in user read files outside the export directory.
    Credit: Anis Bendib, Adam Nurudini (QwesiRED)
    Published
    2026-08-10
    Severity
    Moderate
    Core versions
    8.0.0 to 8.2.12
    Fixed in 8.2.13
    Pro versions
    up to 8.3.0
    Fixed in 8.3.1
    CVE and GHSA
    CVE-2026-64826
    GHSA-m5rw-jcrm-mmwc
    Status
    Fixed
  • Advisory
    rCFG-SA-2026-03
    Unauthenticated self-registration granted the Administrator role
    Self-registration was open and assigned the Administrator role, so anyone who could reach the login page could create an administrator account.
    Credit: Adam Nurudini (QwesiRED)
    Published
    2026-08-10
    Severity
    Critical
    Core versions
    8.0.0 to 8.2.9
    Fixed in 8.2.10
    Pro versions
    6.0.0 to 8.3.0
    Fixed in 8.3.1
    CVE and GHSA
    CVE-2026-77915
    GHSA-w3hx-9cxg-5ccr
    Status
    Fixed
  • Advisory
    rCFG-SA-2026-02
    Privilege escalation through the Users API role field
    A user could set their own role to Administrator through the Users API.
    Credit: manasse
    Published
    2026-07-20
    Severity
    Medium
    Core versions
    before 8.2.8
    Fixed in 8.2.8
    Pro versions
    Not affected
    CVE and GHSA
    CVE-2026-63102
    Status
    Fixed
  • Advisory
    rCFG-SA-2026-01
    Critical vulnerabilities in the PHP runtime
    Published
    2026-10-20
    Severity
    Critical
    Core versions
    PHP older than 8.2.35, 8.3.36, 8.4.27 or 8.5.12
    Pro versions
    PHP older than 8.2.35, 8.3.36, 8.4.27 or 8.5.12
    CVE and GHSA
    CVE-2026-109618
    CVE-2026-109619
    Status
    Closed
  • Advisory
    rCFG-SA-2019-01
    Historical advisory
    Published
    2019-07-10
    Severity
    -
    Core versions
    v3.x
    Pro versions
    Not applicable
    CVE and GHSA
    CVE-2023-39110
    Status
    Resolved
Published security advisories
AdvisoryPublishedSeverityCore versionsPro versionsCVE and GHSAStatus
rCFG-SA-2026-10
Table export disclosed stored credentials and API tokens
The table export did not enforce its list of excluded tables and wrote encrypted columns in clear text, so any signed-in user could export API tokens and stored device, enable and SMTP passwords. After upgrading, revoke and recreate API tokens and rotate stored credentials.
Credit: kta1kri, Samuel Lao		2026-11-06High8.1.0 to 8.2.19
Fixed in 8.2.20		up to 8.3.3
Fixed in 8.4.0		Pending
GHSA-j6h2-mff2-6gwf		Fixed
rCFG-SA-2026-09
Remote code execution via the job queue (Redis and Horizon)
A signed-in user could reach the internal Redis queue through a device pointing at the rConfig server and run commands as the queue worker, which ran as root on some installs. Redis now requires a password, the worker no longer runs as root, and such device targets are blocked.
Credit: Reported via VulnCheck		2026-11-06Critical8.0.0 to 8.2.18
Fixed in 8.2.19		up to 8.4.0
Fixed in 8.4.1		CVE-2026-124079Fixed
rCFG-SA-2026-08
Stored cross-site scripting in the Config Search matches dialog
Stored configuration content could run script in another user's browser when shown in the Config Search matches dialog.		2026-09-10High8.0.0 to 8.2.16
Fixed in 8.2.17		up to 8.3.3
Fixed in 8.4.0		Pending
GHSA-vx3w-xf2x-5335		Fixed
rCFG-SA-2026-07
Authenticated remote code execution via PHP object injection in EncryptStringCast
A crafted stored value could be deserialised by EncryptStringCast, allowing a signed-in user to run code on the server.		2026-09-10High8.0.0 to 8.2.16
Fixed in 8.2.17		up to 8.3.3
Fixed in 8.4.0		Pending
GHSA-66q6-ghqr-4cq2		Fixed
rCFG-SA-2026-06
Device credential passwords returned by the v1 REST API
The v1 REST API returned shared device credential passwords in clear text to any API token holder. These values are now masked.
Credit: Reported via VulnCheck		2026-11-06Medium8.2.3 to 8.2.12
Fixed in 8.2.13		Not affectedCVE-2026-70555Fixed
rCFG-SA-2026-05
Authenticated users could change other users' passwords
The user update endpoint did not check that the caller could change the target account, so any signed-in user could set another user's password, including an administrator's.
Credit: Adam Nurudini (QwesiRED)		2026-11-06High8.0.0 to 8.2.12
Fixed in 8.2.13		up to 8.3.3
Fixed in 8.4.0		Pending
GHSA-5j22-4wg3-pxvh		Fixed
rCFG-SA-2026-04
Authenticated path traversal in the export download endpoint
The export download endpoint accepted path traversal, letting a signed-in user read files outside the export directory.
Credit: Anis Bendib, Adam Nurudini (QwesiRED)		2026-08-10Moderate8.0.0 to 8.2.12
Fixed in 8.2.13		up to 8.3.0
Fixed in 8.3.1		CVE-2026-64826
GHSA-m5rw-jcrm-mmwc		Fixed
rCFG-SA-2026-03
Unauthenticated self-registration granted the Administrator role
Self-registration was open and assigned the Administrator role, so anyone who could reach the login page could create an administrator account.
Credit: Adam Nurudini (QwesiRED)		2026-08-10Critical8.0.0 to 8.2.9
Fixed in 8.2.10		6.0.0 to 8.3.0
Fixed in 8.3.1		CVE-2026-77915
GHSA-w3hx-9cxg-5ccr		Fixed
rCFG-SA-2026-02
Privilege escalation through the Users API role field
A user could set their own role to Administrator through the Users API.
Credit: manasse		2026-07-20Mediumbefore 8.2.8
Fixed in 8.2.8		Not affectedCVE-2026-63102Fixed
rCFG-SA-2026-01
Critical vulnerabilities in the PHP runtime		2026-10-20CriticalPHP older than 8.2.35, 8.3.36, 8.4.27 or 8.5.12PHP older than 8.2.35, 8.3.36, 8.4.27 or 8.5.12CVE-2026-109618
CVE-2026-109619		Closed
rCFG-SA-2019-01
Historical advisory		2019-07-10-v3.xNot applicableCVE-2023-39110Resolved

The 2019 advisory affected v3.x only. The PHP runtime advisory is closed from an rConfig perspective; the risk remains for PHP versions older than the fixed releases, so see the advisory page for the details.

Responsible Disclosure Policy

We actively encourage responsible disclosure from security researchers, customers, and community contributors.

Reporting Instructions

Email

security@rconfig.com

You can also report privately through GitHub: https://github.com/rconfig/rconfig/security/advisories/new

Please include:

  • Detailed description
  • Steps to reproduce
  • Affected versions
  • Contact details

Our Commitments

  • Acknowledgement within 48 hours
  • Transparent communication
  • Coordinated remediation
  • Public disclosure when appropriate

We may offer Hall of Fame recognition or additional rewards depending on severity and impact.

External Resources & Best Practices

  • Every confirmed vulnerability published with affected and fixed versions
  • Researchers credited and CVEs registered through GitHub and VulnCheck
  • Secure Laravel core & hardened API architecture
  • Continuous automated testing & scanning
  • Responsible disclosure guaranteed

Security You Can Trust, Transparency You Can Verify

Request a DemoView Documentation